This vulnerability exists in Moodle's mod_feedback backup restoration functionality when deployed in shared hosting environments that are misconfigured to allow cross-user access to web server files outside the Moodle webroot. An authenticated user with restore feedback module permissions and direct web server access can exploit this to execute a local file inclusion attack. The affected versions include all versions prior to 4.1.10, versions from 4.2.0 up to but not including 4.2.7, and versions from 4.3.0 up to but not including 4.3.4. The vulnerability requires specific hosting misconfiguration and user privileges, limiting its impact to such environments.

An attacker who is an authenticated Moodle user with restore feedback module permissions and direct web server access outside the Moodle webroot in a misconfigured shared hosting environment can perform local file inclusion. This could potentially expose sensitive files or allow code execution depending on the server setup. However, the vulnerability does not affect properly configured environments and requires both specific permissions and hosting misconfiguration.

A patch is available for this vulnerability. Users should upgrade Moodle to versions 4.1.10 or later, 4.2.7 or later, or 4.3.4 or later as appropriate. Additionally, ensure that shared hosting environments are properly configured to prevent unauthorized access to other users' content and restrict direct web server access outside the Moodle webroot. These measures will mitigate the risk of exploitation.